What is the number of computers being managed where the effort and cost of setting up and maintaining and managing a Windows Server Update Services (WSUS) server is the same as individually managing the computers?

In our case, we have about 60 computers, all belonging to the domain, all limited users. However, some are laptops, some are servers (windows 2003 and 2008), a few virtual machines, most XP, and a few Windows 7. Most have common software, like MS Office, but there subsets with various specialized software, such as Quickbooks. My tech guys recommend going to WSUS, but I've been resisting, figuring we were still a bit too small.

My own gross-guesstimate is that 100 computers is the breakeven, but if it's 10, then I've been too conservative. If it's 50 computers, even though we're somewhat over that number, I'll probably leave well enough alone. We currently use various automation tools to manage the computers: group policy, log in scripts, PSExec, and scheduled tasks to crudely do what I imagine WSUS would help us better do with a lot less bandwidth.

  • Might I suggest that if you believe 60 computers is insufficient to warrant WSUS your methodology could probably withstand a serious review. Manually managing updates on that many computers is (or at least should be) a massive amount of work. Unless of course you are simply allowing any and all updates to be installed, which is generally ill-advised. – John Gardeniers Sep 24 '10 at 3:28
  • @John Gardeniers: thank you for phrasing your suggestion so politely :) I don't know the answer which is why I asked; I was just guessing about the complexity of WSUS. I have never used WSUS. And yes, for good or bad, I've configured all machines to get all high-priority / security updates. – Knox Sep 24 '10 at 12:27
  • give WSUS a try. It's really not as intimidating as it's power might suggest. If for any reason you really don't like it it's just as easily removed. (That's all assuming you use GPO to configure the clients to either use or not use WSUS for updates.) – John Gardeniers Sep 25 '10 at 22:17
  • @John Gardeniers - I will give WSUS a try and update this question when I do. Thanks for the advice. – Knox Sep 26 '10 at 18:06

The advantages of WSUS to me are: the ability to choose when and which updates to install and to get reporting on whether those updates succeeded or failed.

If you are updating your machines via Windows/Microsoft Update, even automatically, it's much harder to test individual packages first.

Wish WSUS, I have my machines in various groups, which stagger the updates. If Microsoft releases a bad update which causes problems, only some machines are affected. I also have a dashboard which shows me which updates have failed.

We also have some applications which still require IE6. This is slowly being fazed out, but shows another ability of WSUS — I can prevent some updates from being installed if I know there will be an issue. With normal updates, you would have to sit at the physical machine, uncheck the updates manually, then check the "Do not display again" box.

We have a ridiculous amount of bandwidth, so that was not a concern for me when I moved to WSUS.

To summarize: selection of updates, reporting, and staged updates. I feel like I have a much better idea on the status of my machines.

Yes, you could probably accomplish the same things with scripting, but this method is much more future proof as long as MS maintains WSUS. The transition from XP to 7 and 2003 to 2008 hasn't changed much in terms of how I manage updating.

If you want a hard number, I would say any time you can't personally visit and check on all the machines within an acceptable time frame, then it's too many. For me, I would guess around 20-30. We have around 70 desktops and 30 servers and it's a huge time saver.

  • Very good answer, and I appreciate the examples. Also, in my current (very) crude way, I have the computers configured to get the updates, but don't get reports on if those updates were applied. – Knox Sep 24 '10 at 12:29
  • I used to do something similar and I never realized how often updates can fail. I feel much more in control when dealing with failed updates now (ie. if all machines fail vs all WinXP machines fail vs 1 individual machine). – David Sep 24 '10 at 18:39
  • Although there were many excellent responses, I selected this one as the answer because of the examples and specifically mentioning the reporting. – Knox Sep 24 '10 at 19:04

I don't think it's a specific number of computers issue, it's an automation and security issue. WSUS gives you a much more fine grained control over what updates are deployed, when they are deployed, and to whom they are deployed. It also allows you to essentially force your users to install the updates (by setting deadlines).

If these kinds of things are important to you, then it's worth the effort no matter how many computers you have to support.

There's also the issue of bandwidth (to the internet) management; with WSUS, the WSUS server downloads the updates from MS, and then pushes them to the client machines. So rather than having 50 computers independantly downloading 50GB worth of updates, you have 1. And you can schedule those, so you can predict your bandwidth usage as well.

Again, if that is something significant to you, then it's worth the effort.

  • 1
    This seems about right. Also, deploying WSUS and adding a GPO to tie machines into it is only about a 2-hour job if you've done it before. – Chris Thorpe Sep 23 '10 at 20:46
  • I already force by GPO every client computer to check for and apply updates every night. Servers get done manually. – Knox Sep 23 '10 at 22:09
  • 1
    +1 for bandwidth savings. – nedm Sep 24 '10 at 6:02

What is the number of computers being managed where the effort and cost of setting up and maintaining and managing a Windows Server Update Services (WSUS) server is the same as individually managing the computers?

Two. Well, maybe not on the cost perspective, but from the point of making my life easier, the more I can do from my desk the better. WSUS is very, very cheap to deploy though. It's even free to deploy if you have an existing Windows server you can put it on, and if not, it's just the price of another WIndows license.

Sixty is definately well above any "minimum" for WSUS - at that rate there will be machines you'll forget about or miss one day, and perhaps WSUS will find machines or software you didn't even know needed updates.

Of course, doing everything from my desk means that I actually have to make an effort to go outside and exercise when I get home, but that's a price worth paying.

  • +1 Two is the answer I would have given as well, although I don't understand the reference to cost. WSUS is free and is trivial to get up and running. Even with only two machines the effort to properly manage updates is already halved. – John Gardeniers Sep 24 '10 at 3:25
  • @John - it's not free if you don't have an appropriate server for running it on. It can consume a lot of disk space, so if you're at capacity then it might not be cost effective to purchase a new server for it. – Mark Henderson Sep 24 '10 at 3:54
  • Just to clarify I knew WSUS was free, but I was using cost in the most general sense of time, effort, training and other resources. – Knox Sep 24 '10 at 12:31
  • Two computers seems kind of small for the breakeven point. I have four computers at my house, but can't see setting up a WSUS server there, no matter how good and efficient it is. But I definitely get the point that I'm way above the breakeven point :) – Knox Sep 24 '10 at 12:36
  • I have 10 computers at my house, but 6 of them are at my desk,2 are Apple, one is on a Work domain, and 1 in another room but I can update any time I want. And you may not have a server at home. At work, I can't just interupt other workers to check updates, and I've got other work to do myself. I already had a server for WSUS. Break-even at 2 or 3 computers is a reasonable estimate. – user165568 Apr 8 '14 at 4:33

At 60 I think you're well over the size where you ought to be using WSUS. I'd even suggest using it for a network as small as 30 devices. Below 20 might be questionable, but at 60 I'd definitely be using it.

Cheers, Trevor Sullivan

  • That makes sense to me. – Knox Sep 24 '10 at 12:38
  • I probably should have clarified why a bit more, but everyone else has already done a good job of that. It gives great reporting and visibility into your current patch state. Plus, it's free. :) – Trevor Sullivan Sep 24 '10 at 12:41

I don't think its about a minimum amount of computers as such (though I take the point that below a certain level it isn't worth the bother however you slice it) but rather about controlling risk.

Is the cost of having a managed environment where you can control what patches are pushed to machines, when the push happens and being able to monitor the results of a push more or less than the cost of having to get everyone to remember to visit Windows Update every now and again and dealing with the consequences if someone forgets and gets exploited / loses work due to a bug that could have been patched?

  • We are completely in a managed environment. All machines by GPO policy are set to check and apply updates everynight. – Knox Sep 23 '10 at 22:07
  • 1
    For me, if a network is big and complex enough to make it worth enabling GPOs for anything then its big enough to install WSUS. Disk space aside, there's no real cost outlay in installing it on the server as you've already got a Windows Server licence if you have a domain. – Rob Moir Sep 23 '10 at 22:49

With the time and effort you'll save once you get it all set up you're going to be glad you have WSUS on the job. You're going to have loads of control over what and when you patch and you're provided with reporting capabilities as well. All well worth it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.